1. Field of the Invention
The invention described herein relates to information security, and in particular, relates to the detection of attempts to subvert an information system.
2. Background Art
Modern information systems are plagued by a variety of security problems. Many of these problems arise from the fact that a given information processing component may be connected broadly to a large universe of other components and users. The chief example, of course, is the Internet. Using the Internet, millions of users and their machines are free to interact with one another. Some of these interactions, however, may be malicious. A typical user can be victimized by a virus or worm received through communication with another machine, for example. Other malicious applications can also be sent to a user. Some such applications may, for example, cause the port through which a user typically receives telnet traffic to be changed from the usual TCP port 23. This could allow a malicious user to avoid a firewall that may otherwise be in effect at port 23. Other intrusion attempts may include the transmission of malformed packets that may be sent by hackers in an attempt to confuse applications that are not expecting incoming packets to be packaged as such.
The existing technologies for defending against such attacks tend to require significant processing and memory. One or more packets that contain a virus, for example, can be filtered out, but this requires a filter mechanism that is capable of detecting common viruses. This in turn may require a database of such viruses, or at minimum a database of information that characterizes such viruses. Using such a database, the user that may be under attack can compare an incoming packet to entries in the database. A match would signify that the incoming packet represents a virus.
For some computer systems, the amount of memory required to store such a database, and the level of processing required to execute such defensive measures, may not be a problem. But these requirements may be a problem for other systems. Some information systems have less computing power and/or less memory available to defend against such attacks. Information processing components that have relatively little processing power and/or small amounts of memory are referred to herein as lightweight devices. An example of a lightweight device is a cable modem. A cable modem (CM) can be embodied as a lightweight device, one that can be embedded in a larger component, such as a personal computer or router. While a cable modem will in fact have a processor and memory available, it does not represent a general purpose computing platform. Such an embedded device therefore has limited functionality for functions other than the basic operations required of a cable modem.
There is therefore a need for a system and method that addresses the above security concerns, but which can operate with the limited computational resources of an embedded device or other lightweight device.